Update (7/24): Google's plan to shame sites into employing HTTPS encryption goes into effect today. With today's release of Chrome 68 for desktops, the browser has started flagging all unencrypted HTTP sites as "not secure."
Meanwhile, coinciding with the release of Chrome 68, security researcher Troy Hunt has launched a site called whynohttps.com, which lists the world's top 100 websites that load over an insecure connection without automatically redirecting to a secure, encrypted one.
"HTTPS is now free, easy and increasingly ubiquitous," Hunt wrote on the site. "Yet still, many of the world's largest websites continue to serve content over unencrypted connections, putting users at risk even when no sensitive data is involved."
Original Story (2/8):
Google will take its efforts to shame website owners into encrypting their traffic up another notch this July with the release of Chrome 68.
At that point, Chrome will label all websites that use unencrypted HTTP connections as "Not secure" via a pop up on the left side of the web address bar, no matter the circumstance.
The problem with HTTP is that any data the web page transmits can be potentially spied on, which could expose passwords or credit card information. As a result, Google has been pushing websites to embrace HTTPS encrypted connections.
Over the past two years, the company has been steadily adding "Not secure" alerts to the browser to flag web pages still on HTTP. However, the alerts have only been appearing under certain conditions, like if you start typing information into an HTTP page.
Google decided to gradually roll out the alerts to give website owners time to implement the encryption. But that grace period is coming to an end, the company said in a Thursday blog post. The good news is that more sites are steadily adopting the encryption; 81 of the top 100 sites on the internet now use HTTPS by default, the company said. In addition, 68 percent of Chrome browser traffic over Android and Windows is now encrypted, up 4 points from October.
For now, the "Not secure" alert appears only in gray text with a white information icon next to it. But in the future, Google intends to make the alert red, with a warning triangle attached. Mozilla's Firefox has also been labeling HTTP pages with similar-looking alerts.